diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 9b8c516..1bc4405 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -14,7 +14,7 @@ jobs:
     - uses: actions/checkout@v2
     - uses: actions/setup-go@v2
       with:
-        go-version: 1.19
+        go-version: 1.20
     - run: make test
 
   publish:
@@ -24,27 +24,37 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request'
     steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: actions/cache@v2
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
       - uses: Surgo/docker-smart-tag-action@v1
         id: smarttag
         with:
-          docker_image: ""
+          docker_image: "tsuru/acl-api"
           default_branch: main
           tag_with_sha: "true"
-      - uses: actions/setup-go@v2
+      - name: Handle smart-tag to proper tag var
+        uses: actions/github-script@v6
+        id: handle_tag
         with:
-          go-version: 1.19
-      - uses: actions/checkout@v2
-
-      - uses: imjasonh/setup-ko@v0.6
-        env:
-          KO_DOCKER_REPO: tsuru
-      - env:
-          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-          DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
-          KO_DEFAULTBASEIMAGE: alpine:3.17.1
-          TO_BUILD_TAG: ${{ steps.smarttag.outputs.tag }}
-        run: |
-          export TAGS=$(echo -n "${TO_BUILD_TAG}" | sed 's/://g')
-          echo "Lets build tags: ${TAGS}"
-          echo "${DOCKERHUB_PASSWORD}" | ko login docker.io --username ${DOCKERHUB_USERNAME} --password-stdin
-          ko build -B --platform linux/arm64,linux/amd64 -t ${TAGS}
+          script: |
+            var tag_re = /:/g
+            var orig_tags = `${{steps.smarttag.outputs.tag}}`
+            return orig_tags.replace(tag_re,"")
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+      - uses: docker/build-push-action@v5
+        with:
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.handle_tag.outputs.result }}
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache
+          platforms: linux/amd64,linux/arm64
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index f178621..4a2b533 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,4 +4,5 @@
 *.dll
 *.so
 *.dylib
-*.test
\ No newline at end of file
+*.test
+bin
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..9ca2d91
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,17 @@
+FROM golang:1.20-alpine3.18 AS builder
+COPY . /go/src/github.com/tsuru/acl-api
+WORKDIR /go/src/github.com/tsuru/acl-api
+RUN set -x \
+    && apk add --update gcc git make musl-dev \
+    && make build
+
+FROM alpine:3.18
+COPY --from=builder /go/src/github.com/tsuru/acl-api/bin/acl-api /bin/acl-api
+ARG gke_auth_plugin_version=0.1.1
+ARG TARGETARCH
+RUN set -x \
+    && apk add --update --no-cache curl ca-certificates \
+    && curl -fsSL "https://github.com/traviswt/gke-auth-plugin/releases/download/${gke_auth_plugin_version}/gke-auth-plugin_Linux_$( [[ ${TARGETARCH} == 'amd64' ]] && echo 'x86_64' || echo ${TARGETARCH} ).tar.gz" \
+    |  tar -C /usr/local/bin -xzvf- gke-auth-plugin \
+    && gke-auth-plugin version
+CMD ["/bin/acl-api"]
diff --git a/Makefile b/Makefile
index 183c6da..891d40b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+GO_BUILD_DIR ?= ./bin
+
 .PHONY: fmt
 fmt: ## Run go fmt against code.
 	go fmt ./...
@@ -9,3 +11,11 @@ vet: ## Run go vet against code.
 .PHONY: test
 test: fmt vet ## Run tests.
 	go test ./... -coverprofile cover.out
+
+.PHONY: build
+build: build-dirs
+	CGO_ENABLED=0 go build -o $(GO_BUILD_DIR)/
+
+.PHONY: build-dirs
+build-dirs:
+	@mkdir -p $(GO_BUILD_DIR)